3 ms·With xss you can also inject the code. So no cookie extraction needed imho.by kenniskrag 6y agoWith xss you can also inject the code. So no cookie extraction needed imho.